linux-application-whitelisting / fapolicyd

File Access Policy Daemon
GNU General Public License v3.0
192 stars 55 forks source link

Crash due to lt_read_db returning static string. #214

Closed stridge-cruxml closed 1 year ago

stridge-cruxml commented 1 year ago

I am running fpolicyd-cli --check-path and get a segmentation fault.

lt_read_db() is returning a static string which is then freed.

static const char *db = DB_NAME;
...
lt_read_bd() {
...
if (operation == READ_TEST_KEY)
  return (char *)db;
...
}
...
read_trust_db() {
int mode = READ_TEST_KEY;
...
res = lt_read_db(path, mode, error);
...
if (sscanf(res, DATA_FORMAT, &tsource, &size, sha) != 3) {
    free(res);
    *error = 1;
    return 1;
}
...
}

lt_read_db() returns "trust.db" for me. This causes sscanf check to fail and then attempts free(res) causing a segmentation fault.